The White House Is Sharing Its Internet With Strangers (And More)
Monday, November 9, 2026 · 5-minute read
France has blamed Iranian state-backed hackers for October cyberattacks that knocked out refrigeration control systems at more than 700 supermarkets and retail locations. The attacks caused widespread food spoilage and started at least 15 fires. It's a stark reminder that cyberattacks can cause real, physical damage — not just stolen data.
↗ BleepingComputerRussian cloud services company Beget was hit by a data-wiping malware attack so severe it had to rebuild its entire cloud infrastructure from scratch. The company hasn't disclosed who was responsible. Wiper attacks like this are increasingly used in geopolitical conflicts to cause maximum disruption with no easy recovery.
↗ BleepingComputerAttackers hit French cooperative bank Crédit Mutuel Arkéa through a compromised service provider, pulling off fraudulent transactions worth up to $133 million. The bank had to suspend some of its own systems to stop the bleeding. This is a classic supply chain attack — getting to a big target by going through a smaller, less-defended partner first.
↗ BleepingComputerA flaw nicknamed "SSHole" (CVE-2026-123158) in OpenSSH is being actively exploited in the wild. The bug lets attackers log into accounts where the password has been disabled — accounts that were supposed to be locked. Once in, hackers are running commands, stealing credentials, and installing tools to stay on the system long-term. Any Linux server running a vulnerable version of OpenSSH is at risk.
Attackers hijacked the release automation of the Ethersphere project to push malicious versions of two popular tools — bee-js and Swarm Desktop. Anyone who downloaded or updated these tools got software designed to steal their crypto wallet private key and install a permanent backdoor on their computer. The malicious versions have been pulled, but any device that already installed them remains compromised.
OpenSSH is the software that lets system administrators log into servers remotely. This flaw lets an attacker sign into an account even when that account has no password — a setting meant to prevent logins entirely. Hackers are already using it in real attacks to steal credentials and plant backdoors on Linux systems.
Status: Patch available — update OpenSSH on all Linux systems immediately.
SonicWall makes network security hardware used by thousands of businesses. A new flaw in its SSL-VPN product lets attackers bypass MFA entirely — meaning even if employees have two-factor login enabled, an attacker could skip it and log straight in. SonicWall says this is already being exploited in real attacks.
Status: Patch available — SonicWall has released fixes in its latest SonicOS update.
Two car brands' mobile apps — both using the ForgeRock identity platform — left an administrator console exposed with its default password of "admin:admin" still set. Security researchers used this to take over any customer account and, for connected cars, remotely unlock doors and start engines. This wasn't a sophisticated hack — it was a default password nobody ever changed.
Status: Both vendors patched within two hours of responsible disclosure in February 2026. No customer exploitation was reported.
OpenAI's latest model, GPT-6, has been put to work on security research — and the results are striking. It reportedly found 81 previously unknown flaws in Firefox and 948 bugs in the Linux kernel on its own. This kind of AI-assisted vulnerability discovery is a double-edged sword: defenders can use it to find and fix problems faster, but it also means attackers have access to tools that can uncover weaknesses at a scale and speed that was impossible just a few years ago. The race between offense and defense just got a significant speed boost on both sides.
Imagine if someone ran an extension cord from the Oval Office out to the street and let strangers plug in. That's roughly what's happening with the White House's internet connection right now — and it wasn't a secret government program. Security researchers stumbled onto it by accident.
Security firm Layer3 Intel found that computers inside the Executive Office of the President's dedicated network (AS2650) were quietly acting as exit points for residential proxy services. That means paying customers of these proxy services — anyone, anywhere — could send their internet traffic through the White House's own network address. The activity was detected on 26 out of 30 days between October 5 and November 3, happening mostly in the evenings. Twenty-eight separate proxy services had access.
The culprit appears to be a program called Infatica — software that's often quietly bundled inside free apps. When someone installs an app that includes Infatica, their device starts silently sharing its internet connection with Infatica's paying customers. The problem: Infatica was founded by a Russian man whose previous hosting business was used to attack US election systems in 2016. White House staff appear to have installed apps containing this software on government-connected devices without realizing it.
For regular people, this story has a clear takeaway: free apps are almost never truly free. Many make money by selling access to your internet connection in exactly this way. If a staffer at the most secure address in America can accidentally share the White House's IP address with the world, it can happen to anyone. Be skeptical of free apps, especially ones that ask for broad permissions — and consider what network you're connecting them to.